WordPress 7.1.4 Fixes 22 Security Issues. Here's What to Do

If your website runs on WordPress, there's an update waiting for you this week, and it's one you shouldn't put off. On October 28, WordPress released version 7.1.4, and the WordPress team says that because it's a security release, you should update your sites immediately.

I'll walk through what it fixes in plain English, then give you a short list of what to check.

What happened

WordPress 7.1.4 is a security-only release. The official release notes list 22 vulnerabilities fixed in this one update. For comparison, Patchstack, a WordPress security firm, points out that the last security release, three weeks ago, fixed seven.

Most of the fixes are for something called stored cross-site scripting (XSS). In plain English: someone who can log in and write content on your site could slip in hidden code that runs when you, or another admin, open that page. According to Patchstack, almost all of these require an account first, usually at the Contributor level or higher.

Two of the issues don't need an account at all:

• A flaw in the update process itself. WordPress describes it as a weakness that "can lead to remote code execution during the upgrade window," meaning an attacker could potentially run their own code on your server. Patchstack explains that for the few seconds an update is running, a copy of WordPress sits in a predictable folder (wp-content/upgrade/) that the web can reach. An attacker would have to hit that exact moment, so Patchstack doesn't consider it practical to exploit. But it needs no login, and the window opens again on every update.
• Unpublished design changes. The release notes say changes you've started in the Customizer but haven't published could be seen by visitors who aren't logged in.

The update also refreshes the security certificates WordPress uses to make secure connections, due to what WordPress calls "the eMudhra revocation."

What about older versions?

This is the part that trips people up. WordPress released fixes for older versions too: 7.0.8, 6.9.11, 6.8.12 and so on, all the way back to 4.7.39. If your site is on WordPress 4.6 or older, it gets nothing. Those versions no longer receive security updates.

And even with those older fixes available, WordPress is clear that only the most recent version is actively supported. If your site is a few major versions behind, this is a good week to have that conversation.

Why this matters for your business

A lot of the sites I see have more than one login. A marketing helper, a former employee, an old agency, a guest blogger from two years ago. Every one of those accounts that can write content is a possible way in for most of these flaws. If one of those passwords ends up in the wrong hands, an attacker could use that account to plant code that goes after you when you log in.

The good news is that this one is easy to fix. WordPress notes that sites with automatic background updates turned on will start updating on their own. Many sites are set up that way. Many aren't, and nobody knows until they look.

What I'd check this week

1. Check your WordPress version. Log in and go to Dashboard, then Updates. You want 7.1.4, or the patched release for your branch, like 7.0.8 or 6.9.11. If it says an update is available, click "Update Now".
2. Back up first. Make sure you have a recent backup you can actually restore before you update anything.
3. Update your plugins and theme too. While you're on the Updates screen, take care of those. In my experience, that's where most WordPress trouble starts.
4. Clean up your user list. Go to Users and look at everyone with Contributor, Author, Editor or Administrator access. Patchstack recommends checking who holds Contributor and above. Remove anyone who doesn't need access anymore.
5. Ask your host or developer about one folder. Patchstack suggests blocking web access to wp-content/upgrade/ at the web server and making sure that folder can't be listed in a browser. That closes the one issue here that needs no account.
6. Running a really old version? If you're on anything older than the 7.x line, plan an upgrade rather than relying on backported fixes.

If you're lost, we can help

If you're not sure which version you're on, or you'd rather not click "Update Now" on a site your business depends on, that's normal. HDM has been building and caring for websites out of Springboro, Ohio for 20 years. Send us a request and we'll check your site and tell you plainly what we find, or call us at (513) 668-7344.